engsuitestrezer[.]wixstudio[.]com

PhishDestroy identifies engsuitestrezer.wixstudio.com as an active credential theft phishing domain. The site is currently under investigation following reports of fraudulent login portals designed to harvest user credentials. Threat actors are leveraging the WixStudio platform to deploy convincing impersonation pages, posing a direct risk to individuals and organizations interacting with the service.

This domain was flagged by 2 of 95 VirusTotal vendors as of the latest scan, indicating it remains undetected by most antivirus engines. The domain resolves to IP 34.144.206.118 and utilizes a Let’s Encrypt SSL certificate to enhance legitimacy. Registration details reveal the domain is hosted on Wix’s infrastructure, and while specific creation and trust scores are not publicly available, the absence of detections suggests a recently deployed campaign with evolving tactics.

The status of this threat remains active, and users are strongly advised to avoid interacting with any login prompts or forms hosted on engsuitestrezer.wixstudio.com. Organizations should update threat intelligence feeds to include this domain and IP, implement web filtering rules, and educate employees on recognizing credential harvesting attempts. Report any suspicious activity involving this domain to your security team or a trusted threat intelligence platform immediately to prevent unauthorized access or data breaches.